GHSA-9r64-3wmc-x8m8

Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-50213

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow-providers-snowflake	< 6.4.0	6.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-50213 advisory
https://github.com/apache/airflow/pull/51734 web
https://github.com/apache/airflow/pull/51734/commits/bcf19916738e4a7065a3911814ba1fa32d6fd669 web
https://github.com/apache/airflow web
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-snowflake/PYSEC-2025-51.yaml web
https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3 web